Bounds on the degree of APN polynomials 
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Abstract 

We prove that functions / : — > of the form f{x) = 

+ g{x) where g is any non-affine polynomial are APN on at most 
a finite number of fields Furthermore we prove that when the 

degree of g is less then 7 such functions are APN only if m < 3 where 
these functions are equivalent to x^. 

1 Introduction 

For a given integer m denote by g = 2™ and let J^q be the finite field with q 
elements. We study functions j '■ Tq ^ Tq given by their polynomial repre- 
sentation. Such a function, or polynomial, is called almost perfect nonlinear 
(APN) if for every non-zero a E Tq and every b E J-'g the equation 

f{x) + f{x + a)=b 

admits at most two solutions x G jF2m. Amongst others, APN functions have 
applications in cryptography. Namely, when used as an S-box in a block 
cipher being APN ensures a good resistance against differential attacks. 

Until 2006, there where only very few APN functions known and all of 
them where power mappings. It was even conjectured that any APN function 
is equivalent to one of the known APN power functions. Here equivalence is 
usually defined by saying that two functions /, g : jF2m — > jF2m are equivalent 
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if there exist an affine permutation on T^^ x such that the graph of /, i.e. 
the set {(x, /(x)) : x G ^^2™}, is mapped to the graph of g. This equivalence 
is called CCZ-equivalence (see [6j) and preserves the APN property. 

In |8] the first APN function which was not equivalent to any power func- 
tion was found. Shortly after this, several infinite families of APN functions 
have been discovered, see for example [H El El IH E] • 

The problem of classifying all APN functions seems elusive today. Even 
the problem of classifying all APN power functions is an open problem and 
not a lot progress has been made here. However, there are possible steps that 
can be taken towards a full classification. One approach that already proved 
to be successful is to show that certain polynomials are not APN for infinitely 
many extensions of T^- So here one first fixes a finite field Tq and a function 
f : Tq ^ Tq given as a polynomial in and poses the question if this 

function can be APN on infinitely many extensions of Tq. There is a variety 
of classes of functions for which it can be shown that each function is APN 



at most for a finite number of extensions. For example, Jedlicka [10] studied 
the case of power functions and Voloch [TJ] focused on binomials. Moreover, 
Rodier studied general polynomials with the same approach in 



2 Our Results 

So far the above question has only be treated when the polynomial description 
of / does not depend on n. In this paper we tackle the question if a given 
class of functions can be APN infinitely many often for functions of the form 

/ • -Fq ^ Fq 

fix) = x'^-^ + g{x) 

where g is a fixed polynomial. The description of those functions clearly 
depends on q, and so these functions do not fall into the classes considered 
so far. However for every nonzero x G JF^ we have 

fix) = x'^ + gix) 

and so the equation 

xfix) = 1 + xgix) 

actually does not depend on q anymore, a fact we will use below. Functions 
of the form fix) = x'^~'^ + gix) are in particular interesting for cryptography 
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as another important criterion for functions used in symmetric ciphers is a 
high algebraic degree and functions of the studied form provide the maximal 
degree possible for a balanced function. Moreover, it turns out that these 
functions are in particular suitable for the question posed above. 

The main idea to prove that a given polynomial is APN only for finitely 
many extensions involves the estimation of the number of points on the fol- 
lowing surface X' of the affine equation 

g{xo) + g{,vi) + g{x2) + g{xo + xi + X2) , a 1 

■ ■ ■ XqXiX2[Xq + Xi+X2) = l 

{Xq + Xi ) {X2 + Xi ) [Xq + X2 ) 

associated to a function /. There are three major steps to derive these 
estimations. 

The first, and for most of the classes of functions studied so far the most 
involved step, is to show that the number of points of the associated surface 
can be bounded by applying the Weil bound (or improvements of this bound). 
The second step is the observation that the number of ^^-rational points on 
a certain surface associated to an APN function can be upper bounded. 
The third step consists of applying the Weil bound (or improvements of this 
bound) to get a lower bound on the number of points on the same surface. 
These bounds will involve the field size q. Moreover, if q is large enough, 
the derived lower bound exceeds the upper bound for APN functions and 
this in turn applies that the function can only be APN up to a certain field 
size. This is the approach taken by all the papers that deal with this kind of 
questions. 

For the first step, i.e. for the Weil bound to be applicable to X\ the 
surface X' has to fulfill certain properties. One possibility is to show that 
the surface is absolutely irreducible. For most of the classes studied so far 
the question of absolute irreducibility was the part where one had to make 
further restrictions on the studied functions which where not always fully 
satisfactory. However, for the functions we study the question of absolute 
irreducibility can be answered completely, see the Theorem below. 

Theorem 2.1 Let g G J^q[x\ he any non-affine polynomial. The surface X' 
defined by the affine equation 

9{xo) + g{xi) + g{x2) + g{xo + xi + X2) . , , \ 1 
■ ■ ■ XoXia;2(xo + Xi+X2)^l 

[Xq + Xi){X2 + Xi){Xo + X2) 

is absolutely irreducible. 
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The proof of this Theorem can be found in Section [31 

The second step, i.e. the upper bound on the number of jF^-rational points 
on the surface X' is stated in the corollary below and proven in Section HI 

Corollary 2.1 // the polynomial mapping f{x) = x''"^ + g{x) (g of degree 
d > 3) is APN than the projective surface X' with affine equation 

g{.XQ) + g{xi) + g{x2) + g{xo + xi + X2) , , , n 1 

■ r- ■ r- ■ r XoXiX2[Xq + Xi + X2) = 1 

[Xq + Xi)[X2 + Xi)[Xq + X2) 

has at most Adq + 4g + 8 rational points. 

The final, and straight forward step, is a lower bound on the number of points 
on X'. One possible lower bound is given below. 

Corollary 2.2 The projective surface X' with affine equation 

gixo) + g{xi) + g{x2) + gixo + xi + X2) . , , \ , 

■ ■ ■ XoXiX2{Xo + X1+X2) = 1 

{Xo + Xi){X2 + Xi){Xo + X2) 

has at least + g + 1 — d{d — — 18((i + AYq rational points. 

Proof. As it is proven in Theorem 12.11 that X' is absolute irreducible we can 
apply a result of Lang- Weil [11] improved by Ghorpade-Lachaud ([9!, section 
11]), and deduce 



Hence 
that is 



-q^ -q-l\<d{d- l)g=^/2 ^ ^g^^ ^ 4)4^_ 
-X\J^q) + q^ + q + l<d{d- l)g=^/2 ^ ^g^^ ^ 4)4^_ 
X\J^q) >q^ + q + l-d{d- l)q^/^ - 18{d + A)% 



n 



These results are put together in the next theorem. 



Theorem 2.2 Let g be a polynomial from jFg to Tq, d its degree. Then, if 
d < 0.45gi/^ - 3.5 and > 5 , / is not APN. 
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Proof. From the above it follows that if g^+g+l-(i((i-l)g^/^-18(c/+4)^g > 
4cig+4g+8, then X'{Tq) > Adq+Aq+8, and thus / is not APN. This condition 
can be written as 

g2 - d{d - l)q^/^ - {18{d + 4)^ + 4d + 3)g + 1 > 



or 

q-did- - (18(d + 4)^ + 4rf + 3) + - > 

q 

This condition is fulfilled for g^/^ > 79 + 33.15d + 4.773rf2. Or for d < 
0.45gi/^ - 3.5 and > 5. □ 

Our main result is a corollary of this. 

Corollary 2.3 Let g be any fixed non-affine polynomial function in Tq[x\. 
Then the functions 

f '. — ^ 'Fqn 

fix) = x^"-' + g{x) 
are APN on at most a finite number of fields J^qn. 



2.1 Special cases 

If we fix the degree of g a closer analysis of the surface X' allows to derive 
better bounds on the maximal field size such that the given function can be 
APN. If this maximal size is not too big it can be checked with the help of 
computers if / of the given form can ever be APN by just checking up to the 
maximal possible extension. Following this approach to combine theoretical 
results and computer experiments we prove the following theorem as shown 
in Section [5l 

Theorem 2.3 Let m > 3 and q = be given. Furthermore, let g be any 
non-affine polynomial of degree at most 6 in Tq[x]. Then the function 

f ■ 'Fq 'Fq 

fix) = x'^-' + gix) 

is not APN. 
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Another special case is the case of binomials, i.e. the case where g is 
a monomial ax'^. This case is particularly suitable for checking the APN 
property with the help of computers, as there are at most gcd{d, q — I) non 
equivalent functions of the form x'^~^ + ax"^. This in turn implies that one 
can check all functions of the form at least for field sizes smaller or equal to 
2^^ within hours on a standard PC. For this case Theorem 12. 21 states that if d 
is smaller than 30 the function x'^"^ + ax'^ can be APN only on fields up to a 
size of 2^"^. The following result therefor is again a combination of computer 
search on fields up to that size and Theorem 12. 2[ 

Theorem 2.4 Let q = 2"^ and d a nonzero integer not a power of 2 be given. 
Then the function 

f ■ ■Fq ■^q 

f{x) = x«-2 + ax^ 
is not APN for a G J^* and d<29. 

J q — 



3 Proof of Theorem 12.11 : Irreducibility of X' 



As stated above, one key tool is to apply the Weil bound, or variants, on the 
number of points on certain surfaces. In order for this bound to be applicable 
the surface has to fulfill certain properties. The purpose of this section is to 
show that the surface X' defined by the affine equation 

9{xo) + gixi) + g{x2) + g{xo + xi + X2) , , , n 1 

■ ■ ■ XoXiX2(Xo + Xi + X2) = I 

[Xo + Xi){X2 + Xi)[Xo + X2) 

is absolutely irreducible where g is any fixed polynomial. 
Assume that X' is not absolutely irreducible and denote 

g{xo) + g{xi) + g{x2) + g{xQ + xi + X2) 



(t){xQ,Xi,X2) 



(xO + Xi){x2 + Xi){xq + X2) 

Then one may write, with Pj (resp. Qi) polynomials in 2 (resp. 3) variables: 

1 + 0(Xo, Xi, X2)XoXiX2(Xo + Xi + X2) 
= (Pi(xi,X2) + XqQi{xq,Xi,X2)){P2{xi,X2) + X0Q2 (a^o , a^i , X2) ) 

= Pi(xi,X2)P2(a;i,a;2) 

+Xo(Ql(Xo, Xi, X2)P2(Xi, X2) + Q2{Xq, Xi, X2)Pi(Xi, X2)) + 
+xlQi{xo, Xi, X2)Q2{xq, Xi, X2) 
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One has X2)P2{,Xi, X2) = 1 so Pi(xi, X2) is a nonzero constant, and one 

can suppose that Pi(xi,X2) = 1 and P2{,Xi,X2) = 1. Consequently 

1 + 0(xo, Xi, X2)xoXiX2(xo + Xi + X2) 

= 1 +xo(Qi(xo,xi,X2) + (52(a;o,a;i,X2)) + xlQi{xo,xi,X2)Q2{xo,xi,X2) 

= I + Xo{Qi{0,Xi,X2) + Q2{0,Xi,X2)) + 

2 ( Ql(0,Xi,X2) + (^2(0,3^1,3^2) + Ql(xo,Xi,X2) + Q2{xo,Xi,X2) \ 

[ XO ) + 

xlQi{Xo, Xi, X2)Q2{Xo, Xi, X2) 

and 

1 + 0(xo, Xi, X2)xo3;iX2(xo + Xi + X2) 

= 1 + 0(0, Xi, X2)Xo3;iX2(Xi + X2) + 0(0, Xi, X2)XoXiX2 + 

2 /0(Xo,Xi,X2) +0(O,Xi,X2)\ 

XoXiX2(Xo + Xi + X2) 

\ Xo J 

where the fractions with denominators xq are actually polynomials. Hence 

Ql{0, Xi, X2) + (52(0, Xi, X2) = 0(0, Xi, X2)XiX2(Xi + X2) 

and 

Qi(0, xi, X2) + (^2(0, xi, X2) + Qi(xo, xi, X2) + Q2(xo, xi, X2' 



+ 

Xo 



Ql{xo, Xi, X2)(52(xo, Xi, X2) 

f , , .0(Xo,Xi,X2) +0(O,Xi,X2) 

= XiX2(Xo + Xi + X2) h 0(O,Xi,X2)XiX2 

Xo 

Let d be the degree of g. Remark that the degree of 0(O,Xi,X2) is equal to 
d — 3 (see Lemma [4.21) . Hence 

d = deg(0(O,Xi,X2)xiX2(xi + X2)) < sup(deg(5i, (52) 

and deg Qi + deg Q2<3 + d — 3 — 1. If deg Qi > deg Q2, one has 

d < sup(degQi,Q2) < degQi < degQi + degQ2 < d - 1 

We obtain a contradiction to the assumption that X' is reducible. 



4 Proof of Corollary 12.1 



The Upper Bound 



The purpose of this section is to give a proof of Corollary I2.H i.e. to show 
that the number of rational points on the surface X' can be upper bounded 
if / is APN. The main tool is the following Lemma (see for example [T2]). 

Let / be a a polynomial mapping from jFg to itself which has no terms of 
degree a power of 2. 

Proposition 4.1 The function j : Tq ^ Tq is APN if and only if the 
surface f{xo) + /(xi) + f{x2) + /(xq + Xi + X2) = has all of its rational 
points contained in the surface (xq + Xi)(x2 + Xi)(xo + X2) = 0. 

Before we prove Corollary 12. 11 remark that the polynomial f (xq) + f (xi) + 
/(X2) + /(xo + Xi + X2) is divisible by (xq + Xi)(x2 + Xi)(xo + X2), therefore 
the quotient 

fjxo) + /(xi) + /(X2) + /(xq + Xi + X2) 
(Xo + Xi)(x2 + Xi)(Xo + X2) 

defines a polynomial which is the affine equation of a surface X if the polyno- 
mial is not constant, that is if / is not a g-affine polynomial or a polynomial 
of degree 3. 

We will make use of the following lemmata. 

Lemma 4.1 If d is not a power of 2 and at least 3, and an integer c at least 
2 then the polynomial J2i=i xf + {J2i=i ^lY ^-^ '^cm zero, hence of degree d. 

Proof. Write d = 2"6 with b odd. The polynomial can be written {J2i=i + 
(X]i=i Xi)'')^". The inner polynomial contains a monomial (say 6x1X2^^) of 
degree b. Hence the conclusion. □ 



Lemma 4.2 If degg = d is not a power of 2, then 

g{xo) + g{xi) + g{x2) + gixo + xi + X2) 

(f){Xo,Xi,X2) = r- ^ 

(Xo + Xi)(X2 + Xi)(Xo + X2) 

is a polynomial of degree d — 3. 

Proof. Denote by (pd the term of highest degree of . As it is nonzero and 
as (pd is a rational homogeneous fraction, (pd is of degree d — 3. □ 
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Now we can prove Corollary 12.11 Let the polynomial mapping f{x) = 
x''"^ + g{x) {g of degree li > 3) be APN and X' be the surface with affine 
equation 

gixo) + g{xi) + g{x2) + gixo + xi + X2) , , , n 1 

■ ■ ■ r XoXiX2(Xo + Xi + X2) = I 

[Xq + Xi)[X2 + Xi){Xo + X2) 

Due to Theorem 12.11 X' is absolutely irreducible. We have to show that the 
corresponding projective surface has at most 4dq + 4g + 8 rational points. 

If the surface X' contained the plane Xq + Xi = 0, it would contain also 
the planes X2 + Xi = and Xq + X2 = hj symmetry, which is impossible as 
the surface X' is irreducible. So its intersection with the plane xq + xi = is 
a curve of degree d+ 1. This curve has at most {d+ l)q + 1 rational points 
from Serre [13]. The same argument works for the plane at I'infinity. 

If / is APN, the affine surface X has no other rational points than those 
of the surface (xq + Xi){x2 + a;i)(xo + 2:2) = 0, which is union of a plane 
Xq + Xi = and of its symmetrical plane. 

The set X (JF^) decomposes as follows: 

x\T,) = u x:.^ u x',^ u x;^^,^^,^ u x:, u x;, 

where X^ = X'(jFq)n(a = 0), and X*^. is the affine complement. The equation 
of surface X' may be written as follows 

Xq ^ + g{xo) + x^^ + g{xi) + X2^ + g{x2) + (xq + xi + X2)""^ + g{xo + xi + X2) 

(Xo + Xi)(x2 + Xi)(xo + X2) 

XXoXiX2(Xo + Xi + X2) = 0. 

It means that for xoXiX2(xo + Xi + X2) 7^ 0, the element of the set X*^ fulfill 
f{xo) + /(xi) + /(X2) + /(xo + Xi + X2) 



(xo + Xi)(x2 + xi)(xo + X2) 



X XoXiX2(xo + Xi + X2) = 



which proves that X*^ is contained in X(jF^) hence, as / is APN, in the union 
of the three planes (xq + a:;i)(x2 + xi){xo + X2) = 0. Therefore the number of 
points in X*^. is bounded by 3{{d+ l)q + 1). 

The intersection of the surface X with the plane Xq = is the line Xq = 
in the plane at infinity, which has g + 1 rational points. 
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The equation of the intersection of the surface X with the plane at infinity 

is 

9{xo) + g{xi) + g{x2) + g{xo + xi + X2) , , , n n 

■ ■ ■ XqXiX2[Xo + Xi + X2) = 

(a;o + xi)[x2 + a;i)(xo + X2) 

It contains the hues xqXiX2{xq + xi + X2) = 0, for which we have already 
taken in consideration the points, and the curve 

g{xo) + g{xi) + g{x2) + g{xQ + xi+ X2) _ ^ 

(Xo + Xi){x2 + Xi)(xo + X2) 

which has at most {d — 3)q + 1 rational points. 
So 

= 4(g + l) + 3((rf + l)g + l) + (c/-3)g + l 
= Adq + Aq + S 

which proves the result. 



5 Improvements in specific cases 

Under certain conditions, we can obtain a better bound on the dimension. 

Theorem 5.1 Let g a polynomial mapping from T2^ to itself, d its degree. 
Let us suppose that the surface X' defined by 

g{xo) + gixi) + g{x2) + gixo + xi + X2) . , , \ , 
■ ■ ■ xoXiX2(xo + a;i + X2) = 1 

[Xq + Xi){X2 + Xi){Xo + X2) 

of degree d' = d + 1 has only isolated singular points. Then if d > 3 and 
d < q^l^ , f IS not APN. 

Proof. 

From an improvement of a result of Deligne [7] by Ghorpade-Lachaud 
([9], corollaire 7.2), we deduce 

|X'(^,)-g2_g_i| < 6;(2,rf')g'/' + (&2(3,t/') + l)g 

< {d' -l){d' - 2)g=^/2 ^ ^^/3 _ 4^/2 ^ g^/ _ 

< d{d - l)g3/2 + (2 + d - rf2 + dJ^)q 
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where b[ and 62(3, rf') are Betti numbers (see P]). Hence 

X'iJ^g) >q^ + q + l-d{d- l)g3/2 - (^2 + d - + d^)q 
Therefore if 

q^ + q + l-d{d- l)q^''^ - {2 + d - d^ + d^)q > Adq + 4g + 8, 

then X'{J^q) > Adq + 4g + 8, and / is not APN due to Corollary O This 
condition can be rewritten as 

q-d{d~ _ (5 + 5^ _ ^2 ^ _ > q_ 

It is fulfilled if g > as soon as c? > 3. □ 

5.1 Polynomials g of small degree 

As stated in the introduction the APN property is invariant under the so 
called CCZ-equivalence. As adding affine functions is a special case of CCZ- 
equivalence it is clear that given two functions / and g that differ by an affine 
function / is APN if and only if g is APN. Moreover, multiplying an APN 
polynomial function by a constant or replacing x by any non-constant linear 
polynomial yields again an APN polynomial. These well known observations 
are summarized in the proposition below. 

Proposition 5.1 A polynomial function f is APN if and only if the poly- 
nomial /o obtained by removing all monomials of degree a power of 2 and 
by removing the constant term is APN. Moreover, if f is APN then for any 
nonzero a,c & J^2"^ ond any element b G J?-2m the polynomial function 

of {ax + b) 

is APN. 

This proposition will be used in the reminder of the paper to simplify the 
polynomials we have to study. 
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Polynomials of degree 3 We first focus on polynomials of degree 3. Here, 
the general form of / is 

f{x) = x'^~'^ + a^x"^ + a2x'^ + aix + Qq 

where as 7^ which is clearly equivalent to 

f(x) = x"-^ + asxl 

Moreover, replacing x by and multiplying across by a^^'^ we see that 

/ is in any case equivalent to 

f{x) = x^'^ + x\ 
In this case the affine equation for X' becomes 



1 , g{xo) + g{xi) + g{x2) + g{xo + xi + X2) , , , , 

1 H 7 ■ 77 ■ 77 ■ ^ XoXiX2{Xo +Xi+ X2] 

(xo + xx)[X2 + a;i)(a;o + X2) 

{{x% + + + (Xo + Xi + X2)'^)xiiXxX2{xQ + Xi + X2)) 



(Xo + Xi)(x2 + Xi)(Xo + X2) 
= 1 + XoXiX2(xo + Xi + X2) 



The search of singular points on the surface + xoXiX2(xo + xi + X2) = 
gives a finite number of points. 



Polynomials of degree 5 Next, we study polynomials of degree 5. The 
general form of / (up to adding affine equivalence) is given by 

/(x) = x^~^ + asx^ + asx^ 

Furthermore we can assume without loss of generality that Xs G JF2. We have 
to study the surface 

^, _ I x|] + X? + X^ + (Xo + Xi + X2)^ 

\^ (Xo + Xi) (Xo + X2) (Xi + X2) 

Xj] + X? +X^ + (Xo +Xi +X2)^\ , , , . 

+a5— ■ r- ■ r- ■ — XoXiX2(Xo + Xi + X2) 

(Xo + Xi) (Xo + X2) (Xi + X2) / 

and show that there are only a finite number of singular points. The lengthy 
- but straight forward - computation for showing this can be found in Ap- 
pendix |X1 
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Polynomials of degree 6 Next, we study polynomials of degree 6. The 
general form of / (up to adding affine equivalence) is given by 

/(x) = x"^"^ + flgx^ + a^x^ + a^x^ . 

Furthermore we can assume without loss of generality that X3 E J^2- 
In this case we have to study the surface 

, / xl + x\ + xl + {xo + Xi+ X2f 

— ' \ ^3 — 7 w TT ^ — 

\ [Xo + Xi ) [Xo + X2){Xi + X2) 

Xq + xl+ xl + {xo + Xi+ X2)^ 



+06- 



(XO + Xi)(xo + X2)(xi + X2) 



Xq + X? + Xn + (Xg + Xi + X2)'^\ , , 

+a5—, ■ 77 ■ TT ■ ^ xoXiX2(xo + xi + X2) 

(Xo + Xi ) (Xo + X2) (Xi + X2) / 

and show that there are only a finite number of singular points. We refer to 
Appendix [B] for the proof. 

Conclusion As we have seen above for any non-affine polynomial of degree 
less than 6 the corresponding surface contains only isolated singularities. 
Therefore, Proposition 15.11 applies. Thus if / is APN it holds that q = 
2m ^ g4 implies m < 10. It can easily be checked that functions form 

x^~^ + agx^ + Osx^ + a^x^ are APN only if m < 3. Note that, for m < 3 the 
APN functions are quadratic and moreover for m < 3 all APN functions are 
CCZ equivalent to x^. These considerations finally prove Theorem 12.31 stated 
above. 
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A Singular points for g of degree 5 

We have to study the surface 

^ xl + xl + xl + (Xo + Xi+ X2)^ 



X' =1+ Ua- 



{Xo + Xi){xo + X2){Xi + X2) 



xl + xl+xl + {Xo+Xi+X2f\ . , , s 

+05^ ■ TT ■ TT ■ ^ a;oXiX2(xo + Xi + X2) 

{Xq + Xi) {Xo + X2) [Xi + X2) J 

and show that there are only a finite number of singular points. For this we 
compute the derivatives of the projective version of X' 

X' = a5X2XiXo{xo + xi + X2){xl + xqXi + X0X2 + xj + X1X2 + xl) 

+a3Z^X2XiXo{Xo + Xi+ X2) 

The derivatives of the projective version of X' are as follows 

X2Xi[Xi + X2)r'{Xi, X2, z) 

a;oa^2(a:;o + X2)P{xo, X2, z) 

XoXi{xo + Xi)P{xo, Xi, z) 





dxo 
dX' 

dxi 
dX' 

dX2 

dx' 

dz 



where 



P{x, y, z) = ar,{x^ + + y^) + a^z^ 



To study the singular points of these equations, we make some case distinc- 
tion. 

Case xq — 0: In this case X' simplifies to 2; = and we have 
dX' 

— — (0, xi, X2, 0) = a5X2Xi(xi + X2)(xl + X1X2 + xl) 

OXq 

which, up to equivalence, implies a finite number of singularities . 
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Case = or a;2 = 0: Due to symmetries the cases can be handled 
exactly hke the first case. 

Case xi = X2'- Here we are left with the following system of equations 

a^xlxKxo + X2Y + a^z^x\x1 + 2;^ = 
XqX2{xq -\- X2){ar,{xl -\- XqX2 -\- x\) -\- a^z^) = 

Now if Xq = X2 the first of this equation becomes 

{asx', + z')z' = (1) 

If 03 = then z = and there are, up to equivalence, at most two points 
(1, 1, 1, 0) and (0, 0, 0, 0). For 03 7^ we can assume 03 = 1, see above. Now, 
if 2; 7^ then Xq = z and, up to equivalence, there is only one point (1, 1, 1, 1). 

The case z = and xq = x\ = X2 correspond, up to equivalence to at 
most two points (1, 1,1,0) and (0, 0, 0, 0). 

For xo = or a;2 = see the first case above. Thus we are left with the 
case 

a^,{xl + xqX2 + xl) + a^z'^ = 
a5xlxl{xo + X2)'^ + a^xlxlz^ + = 

Computing the resultants of both equations with respect to xq and X2 we get 

alQ^xo) = and alQ{x2) = 

where 

Q{x) = alx^'^ + a^alx^^ z'^ + ala^x^ z'^ + alx^ z^ + aaa^x^ z^ + a^z^"^ . 

The fact that Q is a non-zero polynomial (as as 7^ 0) implies only a finite 
number of solutions (up to equivalence). 

Case Xq = X2 or xq = xi: Due to symmetries the cases can be handled 
exactly hke the case above. 
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None of the above cases: Here we get the following equations. 

X' ^ 

P{xi,X2,z) = 

P{xo,X2,z) = 
P{xo,xi,z) = 

In particular the singular points have to fulfil 

P{Xi,X2,z) + P{xo,X2,z) = a<i{xo + Xi){Xo + Xi + X2) = 
P{xi,X2, z) + P{xo,X2, z) = a5{xo + X2){xo + Xi + X2) = 
P{Xi,X2,z) + P{Xo,X2,z) = a^ixi + X2){Xq + Xi + X2) = 0. 

The cases Xq = xi or Xo = X2 or Xi = X2 have been studied above. The case 
a^o + 2^1 + 2^2 = implies 2; = (as X' = 0) and then 

P{Xq, X2, 0) = 05(^0 + XqXi + xj) = 

which leaves only a finite number of singularities (up to equivalence) . 

B Singular points for g of degree 6 

We have to study the surface 

^ Xn + xl+ xl + {xq + Xi+ X2)^ 



X' =1+ l^as 

+06 



(Xo + Xi){xo + X2){Xi + X2) 
xl + x'l + X2 + {Xo + Xi+ X2)^ 
{Xo + Xi){xo + X2){xi + X2) 



, xl + xl+ xl + {xo+ Xi+ X2f\ . , , . 

+a5— ■ r-T ■ r-T ■ r— XoXiX2(Xo + Xi + X2) 

(XO + Xi)(Xo + X2)(Xl + 2:2) J 

and show that there are only a finite number of singular points. The compu- 
tations and case distinctions are very similar to the case where g is of degree 
5. 

We compute the derivatives of the projective version of X' 

X' = a6a:2XiXo(xi + X2)(a:o + a;2)(xo + a;i)(a;o + Xl + X2) 

+a52;x2XiXo(xo + Xi + X2){xl + XqXi + X0X2 + xl + X1X2 + xl) 

+a32;^X2XiXo(xo + xi + X2) 

+z' 
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with respect to Xo,Xi, X2 and z. We get 

X2Xi{Xi + X2)P{Xi, X2, Z) 
XoX2{Xo + X2)P{Xo, X2, z) 
XoXi{xo + Xi)P{xo, Xi, z) 



dxo 

dX' 

dxi 
dX' 

dX2 

dx' 

dz 
where 



05X2X1X0 (XO + Xi + X2)(Xo + XqXi + X0X2 + Xi + X1X2 + X2) 

+a32;^X2XiXo(xo + xi + X2) + z^ 
P{x, y, z) = a6xy(x + y) + a^zix"^ + xy + y^) + a^z^ 



To study the singular points of these equations, we make some case distinc- 
tion. 

Case Xo = 0: Then ^(0, Xi, X2) = imphes z — and this simphfies to 



dz 

dx' 



(0,Xi,X2,0) = 05X2X1 (Xi + X2)^ 



dxQ 

= 

which for ag 7^ imphes, up to equivalence, a finite number of singularities. 

Case xi = or X2 = 0: Due to symmetries the cases can be handled 
exactly like the first case. 

Case Xi = X2: In this case we are left with only two non-zero equations, 
namely 

^;^(xo,X2,X2,2;) = XoX2(Xo X2)P(Xo, X2, 2;) 

axi 

^^(xo,X2,X2,-2) = a^xlxl{xQ + X2f + a2.xlxlz^ + z^ 
uz 

Now, if Xo = X2 then xo = xi = X2 and we get 

dX' 

-^(xo, Xo, Xo, z) = (03X0 + z'^)z'^. 
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which has been studied aheady in the case of a degree 5 polynomial (see 
Equation ([T])) 

For a;o = or X2 = see the first case above. Thus we are left with the 
case 

P{xo,X2,z) = 
a^xlxl{xo + X2Y + CLsX^xlz'^ + z^ = 
For this we again distinguish two cases: z = and z 0. For 2; = we get 

P{xo, X2, 0) = aQX2Xo{xo + X2). 

Thus we have either xq = or X2 = which have been handled above, or 
Xq = X2 which gives again at most two points up to equivalence, see above. 

For z ^ we can restrict, up to equivalence, to the case z = 1. In this 
case we get 

a6XoX2{xo + X2) + a;s{xl + X0X2 + xl) + as = 
a^xlxl^xo + X2Y + a^xlxl + 1 = 

Computing the resultant of these two equations with respect to Xq and X2 
we get 

Q{xo) = and Q{x2) = 

where 

Q{x) = (asagOg + al)x^'^ + (agagOg + a2,al)x^^ + {ala^al + OgCg + asag)^^ 
+ {alal + alal)x^ + (0305 + ag)x'^ + 

For 05 7^ Q is a non-zero polynomial as its constant term is non-zero. For 
= Q is non-zero as the degree 4 term is non-zero. Therefore, in any case 
we get at most finitely many points. 

Case Xq = X2 or xq = Xii Due to symmetries the cases can be handled 
exactly like the case above. 

None of the above cases: In this case we have to study 

P{Xi,X2,z) = 
P{Xo,X2,z) = 

P{xo,xi,z) = 
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This implies that Xo,Xi,X2,z are solutions to the following set of equations: 

P{xi,X2, z) + P{xo,X2, z) = {aQX2 + a5z){xo + Xi){xo + xi + X2) = 
P{xi,X2,z) + P{xo,X2,z) = {aaXi + a5z){xo + X2){xo + xi + X2) = 
P{xi,X2,z) + P{xo,X2,z) = {aeXo + a5z){xi + X2){xo + xi + X2) = 

The cases xq = x\ or xq = X2 or xi = X2 have been studied above. The case 
xo + + X2 = implies z — {as X' = 0) and as seen above 

P{xo, X2, 0) = 06X2X0(^0 + X2), 

and we are back to cases studied before. Thus the only case left is 



which implies Xq = Xi = X2 and, up to equivalence, at most two points. 



(06^2 + 052;) 
{aeXi + a^z) 
{aeXo + a^z) 
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